chore: relocate backend into apps/api ahead of monorepo merge

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/api/models/users/user_sessions.mdl.js

@@ -0,0 +1,60 @@
+/***********************************************************************************************************************************************************************
+ * File Name: user_sessions.mdl.js
+ * Type of Program: Model
+ * Description: Sequelize model for the `user_sessions` table.
+ *              Captures login and logout audit data (IP, geo, device) as JSONB.
+ *              Has a Many-to-One relationship with Users.
+ * Author: rgrgogu
+ * Date Created: Oct. 6, 2025
+ ***********************************************************************************************************************************************************************
+ * Change History:
+ * DATE                AUTHOR      LOG    DESCRIPTION
+ * Oct. 6, 2025        rgrgogu     001    Initial creation - STAR Phase 1
+ ***********************************************************************************************************************************************************************/
+const { DataTypes } = require('sequelize');
+const sequelize = require('../../config/db.config');
+const mdl_Users = require('./users.mdl');
+
+const mdl_UserSessions = sequelize.define('UserSessions', {
+  session_id: { type: DataTypes.BIGINT, primaryKey: true, autoIncrement: true },
+  user_id: {
+    type: DataTypes.BIGINT,
+    allowNull: false,
+    references: { model: mdl_Users, key: 'user_id' },
+  },
+  /**
+   * login_info / logout_info JSONB:
+   * {
+   *   date: ISO string,
+   *   ip_address: string,
+   *   country: string,
+   *   region: string,
+   *   city: string,
+   *   lat: number,
+   *   long: number,
+   *   device_info: { ua, browser, os, device }
+   *   forced_by: user_id
+   * }
+   */
+  login_info:  { type: DataTypes.JSONB, allowNull: true },
+  logout_info: { type: DataTypes.JSONB, allowNull: true },
+
+  // Store the refresh-token hash so we can invalidate individual sessions
+  refresh_token_hash: { type: DataTypes.TEXT, allowNull: true },
+  is_active: { type: DataTypes.BOOLEAN, defaultValue: true },
+
+  // ── Audit trails ────────────────────────────────────────────────────────────
+  createdBy:  { type: DataTypes.BIGINT, allowNull: true, label: "Created By" },
+  updatedBy:  { type: DataTypes.BIGINT, allowNull: true, label: "Modified By" },
+  deletedBy:  { type: DataTypes.BIGINT, allowNull: true, label: "Deleted By" },
+}, {
+  tableName: 'user_sessions',
+  timestamps: true,
+  paranoid:   true,       // enables soft delete — sets deleted_at instead of DELETE
+});
+
+// Associations
+mdl_UserSessions.belongsTo(mdl_Users, { foreignKey: 'user_id' });
+mdl_Users.hasMany(mdl_UserSessions, { foreignKey: 'user_id' });
+
+module.exports = mdl_UserSessions;